In the event you thought Strava’s privacy issues had been unhealthy, strap in: Coros has confirmed some main safety points with its watches. Throughout an evaluation of Coros Tempo 3 Bluetooth safety, German IT safety researchers identified at least eight distinct safety flaws that have an effect on each Coros system in the marketplace—not simply the Pace 3 model, as was first believed. After an initially lackluster response, Coros has since entered harm management mode, and is promising fixes by the top of summer time.
How Bluetooth makes Coros watches susceptible
The vulnerabilities stem from basic points within the Bluetooth connectivity code shared throughout all Coros watches and their bike laptop, making a safety nightmare that impacts the corporate’s complete product lineup.
By exploiting these safety flaws, an unauthenticated attacker inside Bluetooth vary can carry out the next actions:
-
Hijack person accounts and entry all saved health knowledge on COROS.com
-
Listen in on delicate data together with textual content messages and notifications
-
Manipulate system settings remotely with out person information
-
Manufacturing facility reset gadgets from a distance, wiping all person knowledge
-
Crash gadgets throughout important moments
-
Interrupt lively exercises and pressure the lack of recorded health knowledge
In the event you’re focused on diving into the precise coding and architectural points at play right here, I extremely suggest looking at the original blog post outlining the problem. Maybe most regarding is the power for attackers to inject false data, equivalent to pretend textual content notifications, whereas concurrently monitoring all real messages and notifications despatched to the watch.
When alerted to those huge safety holes, Coros initially appeared lower than alarmed. The safety researchers adopted customary trade protocol, privately disclosing the vulnerabilities with the corporate and offering a 90-day window for it to supply fixes earlier than going public. At first, the corporate indicated that fixes would not arrive till the top of 2025—a lower than pressing response. Solely after the vulnerabilities had been publicly disclosed on June seventeenth, 2025, full with detailed replica steps and exploit code, did Coros start taking the state of affairs significantly.
What Coros customers have to do
The corporate has now accelerated its timeline, promising partial fixes by the top of July and full decision by August.
The preliminary response from Coros seems to have handled these important safety flaws as routine bugs, which may be chalked as much as inexperience: Although the problems are regarding, this does look like the corporate’s first main safety incident,. Gadget reviewer DC Rainmaker—the identical reporter chargeable for escalating this problem to Coros within the first place—posits that after this, Coros will probably have higher public channels and inner processes in place for tackling future safety points.
What do you assume thus far?
However that problem apart, what do you might want to do in the event you personal an affected system?
In a Reddit comment, Coros says in case your watch is updated, there’s nothing you might want to do proper now. However when their subsequent software program updates can be found in July and August, you need to replace your watch instantly to repair these vulnerabilities. Sadly, there aren’t any efficient workarounds to mitigate the vulnerabilities within the meantime, as they’re embedded within the gadgets’ Bluetooth communication protocols.
The underside line
Even in the event you aren’t a Coros person, it is vital to keep in mind that all health wearables, regardless of their seemingly benign nature, can turn out to be important safety liabilities. These gadgets typically have entry to extremely private data—from well being knowledge and placement monitoring to textual content messages and notifications—making them enticing targets for hackers. As our wearables turn out to be more and more subtle and related, it is extra vital than ever to remain on prime of finest safety practices.
And in case you are a Coros person, be sure to set up any and all July and August updates as quickly as they’re launched.
Trending Merchandise
